CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

Multiple vulnerabilities in WordPress (August 07, 2026)

unknownpublic exploitCVE-2026-64638
Multiple vulnerabilities have been discovered in WordPress. Some of them allow an attacker to cause privilege escalation, breach of data confidentiality and server-side request forgery (SSRF).

CSIRTS triage

vendor: WordPressproduct: WordPressPrivilege escalationInformation disclosureServer-side request forgery
What
Multiple vulnerabilities in WordPress enable privilege escalation, data breach, and server-side request forgery attacks.
Who is affected
WordPress installations running affected versions; both self-hosted and plugin users.
Urgency
Moderate to high; privilege escalation and SSRF pose direct security risks.
Action
Update WordPress and all plugins to the latest patched versions immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch WordPress

Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-FR Avis de sécurité (FR · national-cert · site)
Severity
unknown
Published
2026-08-07
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0979/

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-64638coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-FR Avis de sécurité